CONSENSUS ASSESSMENTS coMwork srl Impresa Sociale · 0000001 CONSENSUS ASSESSMENTS INITIATIVE...
Transcript of CONSENSUS ASSESSMENTS coMwork srl Impresa Sociale · 0000001 CONSENSUS ASSESSMENTS INITIATIVE...
0000001
CONSENSUS ASSESSMENTS INITIATIVE QUESTIONNAIRE v3.0.1 coMwork srl Impresa Sociale
Control Domain Question ID Consensus Assessment Questions Consensus Assessment Answers Notes
Yes No Not Applicable
Application & Interface SecurityApplication Security
AIS-01.1 Do you use industry standards (Build Security in Maturity Model [BSIMM] benchmarks, Open Group ACS Trusted Technology Provider Framework, NIST, etc.) to build in security for your Systems/Software Development Lifecycle (SDLC)?
XThe development life cycle integrates industry best practices including formal security team reviews, threat modeling and completion of a risk assessment according to the OWASP standard
AIS-01.2 Do you use an automated source code analysis tool to detect security defects in code prior to production?
X https://www.swascan.com/
AIS-01.3 Do you use manual source-code analysis to detect security defects in code prior to production?
XUnit testings and integration testings are in place to detect security defects prior to production
AIS-01.4 Do you verify that all of your software suppliers adhere to industry standards for Systems/Software Development Lifecycle (SDLC) security?
X
AIS-01.5 (SaaS only) Do you review your applications for security vulnerabilities and address any issues prior to deployment to production?
X We do human driven code reviews and automated tests during development and before pushing any changes to production Application & Interface
SecurityCustomer Access Requirements
AIS-02.1 Are all identified security, contractual, and regulatory requirements for customer access contractually addressed and remediated prior to granting customers access to data, assets, and information systems?
X
All data access and security requirements are included in our term and contition and SLA documents that customer must accept at registration
AIS- 02.2 Are all requirements and trust levels for customers’ access defined and documented?
X
0000002
Application & Interface SecurityData Integrity
AIS-03.1 Are data input and output integrity routines (i.e., reconciliation and edit checks) implemented for application interfaces and databases to prevent manual or systematic processing errors or corruption of data?
X
Application & Interface SecurityData Security / Integrity
AIS-04.1 Is your Data Security Architecture designed using an industry standard (e.g., CDSA, MULITSAFE, CSA Trusted Cloud Architectural Standard, FedRAMP, CAESARS)?
X There is no explicit compliance on the application side as we are using a cloud service provider for all infrastructure but there is full compliance on the Saas/PaaS/IaaS side (Enter Suite Cloud)
Audit Assurance & ComplianceAudit Planning
AAC-01.1 Do you produce audit assertions using a structured, industry accepted format (e.g., CloudAudit/A6 URI Ontology, CloudTrust, SCAP/CYBEX, GRC XML, ISACA's Cloud Computing Management Audit/Assurance Program, etc.)?
X The software is provided as a service and there are no resources, hosts, domains or computingresources in control of the users.
Audit Assurance & ComplianceIndependent Audits
AAC-02.1 Do you allow tenants to view your SOC2/ISO 27001 or similar third-party audit or certification reports?
X Our clients and stakeholders are informed about all the IaaS/SaaS our platform uses and are redirected upon request to the relevant certification reports for any provider.
AAC-02.2 Do you conduct network penetration tests of your cloud service infrastructure regularly as prescribed by industry best practices and guidance?
X Our Cloud provider performs vulnerability assessments and penetration tests regularly and security breaches are identified and fixed timely.
AAC-02.3 Do you conduct application penetration tests of your cloud infrastructure regularly as prescribed by industry best practices and guidance?
X Once a year an externally contracted security firm performs a full application vulnerability scan on the public/exposed endpoints and services. The report from this scan is then submitted and used to create actionable items that are solved during the iteration cycle
0000003
Audit Assurance & ComplianceIndependent Audits
AAC-02.4 Do you conduct internal audits regularly as prescribed by industry best practices and guidance?
X There is an internal annual security evaluation, credentials rotation and all collaborators and employees are continuosly formed and instructed on best data and security practices
AAC-02.5 Do you conduct external audits regularly as prescribed by industry best practices and guidance?
X
AAC-02.6 Are the results of the penetration tests available to tenants at their request?
X
AAC-02.7 Are the results of internal and external audits available to tenants at their request?
X
AAC-02.8 Do you have an internal audit program that allows for cross-functional audit of assessments?
X
Audit Assurance & ComplianceInformation System Regulatory Mapping
AAC-03.1 Do you have the ability to logically segment or encrypt customer data such that data may be produced for a single tenant only, without inadvertently accessing another tenant's data?
X All customer data is segmented by tenant ID and all data operations are keyed based on this ID.
AAC-03.2 Do you have the capability to recover data for a specific customer in the case of a failure or data loss?
X
AAC-03.3 Do you have the capability to restrict the storage of customer data to specific countries or geographic locations?
X Data is stored in Italy (Milan) Germany (Frankfurt) and Netherlands (Amsterdam) and data can't be moved to a differentregion
AAC-03.4 Do you have a program in place that includes the ability to monitor changes to the regulatory requirements in relevant jurisdictions, adjust your security program for changes to legal requirements, and ensure compliance with relevant regulatory requirements?
X
Business Continuity Management & Operational ResilienceBusiness Continuity Planning
BCR-01.1 Do you provide tenants with geographically resilient hosting options?
X
0000004
Business Continuity Management & Operational ResilienceBusiness Continuity Planning
BCR-01.2 Do you provide tenants with infrastructure service failover capability to other providers?
X
Business Continuity Management & Operational ResilienceBusiness Continuity Testing
BCR-02.1 Are business continuity plans subject to testing at planned intervals or upon significant organizational or environmental changes to ensure continuing effectiveness?
X Meetings are scheduled every months, plus straordinary meetings (with relevant stakeholders) are organized whenever significant changes occour
Business Continuity Management & Operational ResiliencePower / Telecommunications
BCR-03.1 Do you provide tenants with documentation showing the transport route of their data between your systems?
X Data is stored in Italy (Milan) Germany (Frankfurt) and Netherlands (Amsterdam) and data can't be moved to a different RegionBCR-03.2 Can tenants define how their data is transported and
through which legal jurisdictions?X
Business Continuity Management & Operational ResilienceDocumentation
BCR-04.1 Are information system documents (e.g., administrator and user guides, architecture diagrams, etc.) made available to authorized personnel to ensure configuration, installation and operation of the information system?
X The tenant receives usage documentation, but no installation, configuration or operations of any systems are performed on their part. The tenants are users of the system with no control on its installation, configuration or operations.
Business Continuity Management & Operational ResilienceEnvironmental Risks
BCR-05.1 Is physical protection against damage (e.g., natural causes, natural disasters, deliberate attacks) anticipated and designed with countermeasures applied?
X
we use a full third party cloud solution. Enter Cloud Suite is ISO27001:2013 certified since 2014, and is now undergoing both the ISO27018:2014 (cloud service provider standard)
Business Continuity Management & Operational ResilienceEquipment Location
BCR-06.1 Are any of your data centers located in places that have a high probability/occurrence of high-impact environmental risks (floods, tornadoes, earthquakes, hurricanes, etc.)?
X
Business Continuity Management & Operational ResilienceEquipment Maintenance
BCR-07.1 If using virtual infrastructure, does your cloud solution include independent hardware restore and recovery capabilities?
X
we provide a full SaaS service, so the tenants do not need Virtual Machine
BCR-07.2 If using virtual infrastructure, do you provide tenants with a capability to restore a Virtual Machine to a previous state in time?
X
0000005
Business Continuity Management & Operational ResilienceEquipment Maintenance
BCR-07.3 If using virtual infrastructure, do you allow virtual machine images to be downloaded and ported to a new cloud provider?
Xwe provide a full SaaS service, so the tenants do not need Virtual Machine
BCR-07.4 If using virtual infrastructure, are machine images made available to the customer in a way that would allow the customer to replicate those images in their own off-site storage location?
X
BCR-07.5 Does your cloud solution include software/provider independent restore and recovery capabilities?
X
Business Continuity Management & Operational ResilienceEquipment Power Failures
BCR-08.1 Are security mechanisms and redundancies implemented to protect equipment from utility service outages (e.g., power failures, network disruptions, etc.)?
X we use a full third party cloud solution. Enter Cloud Suite is ISO27001:2013 certified since 2014, and is now undergoing both the ISO27018:2014 (cloud service provider standard)
Business Continuity Management & Operational Resilience Impact Analysis
BCR-09.1 Do you provide tenants with ongoing visibility and reporting of your operational Service Level Agreement (SLA) performance?
X Tenants can read our SLA on thei r profile page
BCR-09.2 Do you make standards-based information security metrics (CSA, CAMM, etc.) available to your tenants?
X
BCR-09.3 Do you provide customers with ongoing visibility and reporting of your SLA performance?
X We use Zendesk
Business Continuity Management & Operational ResiliencePolicy
BCR-10.1 Are policies and procedures established and made available for all personnel to adequately support services operations’ roles?
XBeing a SaaS all data retention policies a tenant might have are dependant on the subscription being continued. Upon subscription termination all data is dumped and provided to the tenant.Business Continuity
Management & Operational ResilienceRetention Policy
BCR-11.1 Do you have technical control capabilities to enforce tenant data retention policies?
X
0000006
Business Continuity Management & Operational ResilienceRetention Policy
BCR-11.2 Do you have a documented procedure for responding to requests for tenant data from governments or third parties?
X There is no internal documentation at time of writing to comply for a government data request, but the required procedures and methodologies are already in place and data can be presented upon request.
BCR-11.4 Have you implemented backup or redundancy mechanisms to ensure compliance with regulatory, statutory, contractual or business requirements?
X
All backup data storage and recovery is performed by Enter Cloud Suite https://www.entercloudsuite.com/en/products/computing/
BCR-11.5 Do you test your backup or redundancy mechanisms at least annually?
X
Change Control & Configuration ManagementNew Development / Acquisition
CCC-01.1 Are policies and procedures established for management authorization for development or acquisition of new applications, systems, databases, infrastructure, services, operations and facilities?
X
At the time there is no plan on acquiring any external services or providers and this has not happened in the past.
CCC-01.2 Is documentation available that describes the installation, configuration, and use of products/services/features?
X The documentation provided allows the client to configure their platform, and every new relevant update is communicated to them and the relevant documentation updatedChange Control &
Configuration ManagementOutsourced Development
CCC-02.1 Do you have controls in place to ensure that standards of quality are being met for all software development?
X
The CIO and internal development team performs quality and security checks
CCC-02.2 Do you have controls in place to detect source code security defects for any outsourced software development activities?
X
Change Control & Configuration ManagementQuality Testing
CCC-03.1 Do you provide your tenants with documentation that describes your quality assurance process?
X
CCC-03.2 Is documentation describing known issues with certain products/services available?
X
0000007
Change Control & Configuration ManagementQuality Testing
CCC-03.3 Are there policies and procedures in place to triage and remedy reported bugs and security vulnerabilities for product and service offerings?
X
The development lifecycle incorporates industry best practices which include design reviews about secuity, threat modeling and completion of a risk assessment.
CCC-03.4 Are mechanisms in place to ensure that all debugging and test code elements are removed from released software versions?
X
Change Control & Configuration ManagementUnauthorized Software Installations
CCC-04.1 Do you have controls in place to restrict and monitor the installation of unauthorized software onto your systems?
X Users have no access to the relevant hosts, there is no internal access to the hosts themselves except via a monitored bastion host with ip and credentials login restrictions
Change Control & Configuration ManagementProduction Changes
CCC-05.1 Do you provide tenants with documentation that describes your production change management procedures and their roles/rights/responsibilities within it?
X
Data Security & Information Lifecycle ManagementClassification
DSI-01.1 Do you provide a capability to identify virtual machines via policy tags/metadata (e.g., tags can be used to limit guest operating systems from booting/instantiating/transporting data in the wrong country)?
X
DSI-01.2 Do you provide a capability to identify hardware via policy tags/metadata/hardware tags (e.g., TXT/TPM, VN-Tag, etc.)?
X
DSI-01.3 Do you have a capability to use system geographic location as an authentication factor?
X The software is provided as a service, so logins must be made possible from any geographical location. Strict user IP provenance is monitored and if a user logs in from an unknown of unseen IP a notification is sent to the user.
DSI-01.4 Can you provide the physical location/geography of storage of a tenant’s data upon request?
X All data is stored in Italy, Germany and Netherlands. The system is GDPR compliant
DSI-01.5 Can you provide the physical location/geography of storage of a tenant's data in advance?
X
0000008
Data Security & Information Lifecycle ManagementClassification
DSI-01.6 Do you follow a structured data-labeling standard (e.g., ISO 15489, Oasis XML Catalog Specification, CSA data type guidance)?
X ICCD https://github.com/ICCD-MiBACT/Standard-catalografici
DSI-01.7 Do you allow tenants to define acceptable geographical locations for data routing or resource instantiation?
X
Data Security & Information Lifecycle ManagementData Inventory / Flows
DSI-02.1 Do you inventory, document, and maintain data flows for data that is resident (permanent or temporary) within the services' applications and infrastructure network and systems?
X
The system has been designed to be GDPR compliant
DSI-02.2 Can you ensure that data does not migrate beyond a defined geographical residency?
X
Data Security & Information Lifecycle ManagementE-commerce Transactions
DSI-03.1 Do you provide open encryption methodologies (3.4ES, AES, etc.) to tenants in order for them to protect their data if it is required to move through public networks (e.g., the Internet)?
X
DSI-03.2 Do you utilize open encryption methodologies any time your infrastructure components need to communicate with each other via public networks (e.g., Internet-based replication of data from one environment to another)?
X
Data Security & Information Lifecycle ManagementHandling / Labeling / Security Policy
DSI-04.1 Are policies and procedures established for labeling, handling and the security of data and objects that contain data?
X
DSI-04.2 Are mechanisms for label inheritance implemented for objects that act as aggregate containers for data?
X
Data Security & Information Lifecycle ManagementNonproduction Data
DSI-05.1 Do you have procedures in place to ensure production data shall not be replicated or used in non-production environments?
X Production and others environment are in isolated. The credential are different for each environment, so we don't need any internal procedure. Different DB Schema are present in each environment, so even if an application bug tried to propagate the data it would fail during inception due to schema incompatibilities.
0000009
Data Security & Information Lifecycle ManagementOwnership / Stewardship
DSI-06.1 Are the responsibilities regarding data stewardship defined, assigned, documented, and communicated?
X
We are GDPR compliant and we have privacy policy and terms of service that specify required information
Data Security & Information Lifecycle ManagementSecure Disposal
DSI-07.1 Do you support secure deletion (e.g., degaussing/cryptographic wiping) of archived and backed-up data as determined by the tenant?
X Internal Enter Cloud Suite procedure already do this when data deletion occurs.
DSI-07.2 Can you provide a published procedure for exiting the service arrangement, including assurance to sanitize all computing resources of tenant data once a customer has exited your environment or has vacated a resource?
XThe procedure exists internally but it's not yet documented to be publicly released. It will be by Q2 2019.
Datacenter SecurityAsset Management
DCS-01.1 Do you maintain a complete inventory of all of your critical assets that includes ownership of the asset?
X We provie a Software as a service, Enter has documented practices for this.
DCS-01.2 Do you maintain a complete inventory of all of your critical supplier relationships?
X
Datacenter SecurityControlled Access Points
DCS-02.1 Are physical security perimeters (e.g., fences, walls, barriers, guards, gates, electronic surveillance, physical authentication mechanisms, reception desks, and security patrols) implemented?
X
Datacenter SecurityEquipment Identification
DCS-03.1 Is automated equipment identification used as a method to validate connection authentication integrity based on known equipment location?
X
Datacenter SecurityOffsite Authorization
DCS-04.1 Do you provide tenants with documentation that describes scenarios in which data may be moved from one physical location to another (e.g., offsite backups, business continuity failovers, replication)?
X
Datacenter SecurityOffsite Equipment
DCS-05.1 Can you provide tenants with evidence documenting your policies and procedures governing asset management and repurposing of equipment?
X
Datacenter SecurityPolicy
DCS-06.1 Can you provide evidence that policies, standards, and procedures have been established for maintaining a safe and secure working environment in offices, rooms, facilities, and secure areas?
X
00000010
Datacenter SecurityPolicy
DCS-06.2 Can you provide evidence that your personnel and involved third parties have been trained regarding your documented policies, standards, and procedures?
X
Datacenter SecuritySecure Area Authorization
DCS-07.1 Do you allow tenants to specify which of your geographic locations their data is allowed to move into/out of (to address legal jurisdictional considerations based on where data is stored vs. accessed)?
X
Datacenter SecurityUnauthorized Persons Entry
DCS-08.1 Are ingress and egress points, such as service areas and other points where unauthorized personnel may enter the premises, monitored, controlled and isolated from data storage and process?
X
Datacenter SecurityUser Access
DCS-09.1 Do you restrict physical access to information assets and functions by users and support personnel?
X
Encryption & Key ManagementEntitlement
EKM-01.1 Do you have key management policies binding keys to identifiable owners?
X X
Encryption & Key ManagementKey Generation
EKM-02.1 Do you have a capability to allow creation of unique encryption keys per tenant?
X Tenants do not have access to encryption keys and do not require it for operating the SaaS
EKM-02.2 Do you have a capability to manage encryption keys on behalf of tenants?
X
EKM-02.3 Do you maintain key management procedures? XEKM-02.4 Do you have documented ownership for each stage of the
lifecycle of encryption keys?X
EKM-02.5 Do you utilize any third party/open source/proprietary frameworks to manage encryption keys?
X
Encryption & Key ManagementEncryption
EKM-03.1 Do you encrypt tenant data at rest (on disk/storage) within your environment?
X
EKM-03.2 Do you leverage encryption to protect data and virtual machine images during transport across and between networks and hypervisor instances?
X
EKM-03.3 Do you support tenant-generated encryption keys or permit tenants to encrypt data to an identity without access to a public key certificate (e.g., identity-based encryption)?
X
00000011
Encryption & Key ManagementEncryption
EKM-03.4 Do you have documentation establishing and defining your encryption management policies, procedures, and guidelines?
X
Encryption & Key ManagementStorage and Access
EKM-04.1 Do you have platform and data appropriate encryption that uses open/validated formats and standard algorithms?
X
EKM-04.2 Are your encryption keys maintained by the cloud consumer or a trusted key management provider?
X
EKM-04.3 Do you store encryption keys in the cloud? XEKM-04.4 Do you have separate key management and key usage
duties?X
Governance and Risk ManagementBaseline Requirements
GRM-01.1 Do you have documented information security baselines for every component of your infrastructure (e.g., hypervisors, operating systems, routers, DNS servers, etc.)?
X
GRM-01.2 Do you have the capability to continuously monitor and report the compliance of your infrastructure against your information security baselines?
X
GRM-01.3 Do you allow your clients to provide their own trusted virtual machine image to ensure conformance to their own internal standards?
X
Governance and Risk ManagementRisk Assessments
GRM-02.1 Do you provide security control health data in order to allow tenants to implement industry standard Continuous Monitoring (which allows continual tenant validation of your physical and logical control status)?
X
GRM-02.2 Do you conduct risk assessments associated with data governance requirements at least once a year?
X
Governance and Risk ManagementManagement Oversight
GRM-03.1 Are your technical, business, and executive managers responsible for maintaining awareness of and compliance with security policies, procedures, and standards for both themselves and their employees as they pertain to the manager and employees' area of responsibility?
X
Governance and Risk ManagementManagement Program
GRM-04.1 Do you provide tenants with documentation describing your Information Security Management Program (ISMP)?
X
GRM-04.2 Do you review your Information Security Management Program (ISMP) at least once a year?
X
00000012
Governance and Risk ManagementManagement Support / Involvement
GRM-05.1 Do you ensure your providers adhere to your information security and privacy policies?
X
Governance and Risk ManagementPolicy
GRM-06.1 Do your information security and privacy policies align with industry standards (ISO-27001, ISO-22307, CoBIT, etc.)?
X
GRM-06.2 Do you have agreements to ensure your providers adhere to your information security and privacy policies?
X
GRM-06.3 Can you provide evidence of due diligence mapping of your controls, architecture, and processes to regulations and/or standards?
X
GRM-06.4 Do you disclose which controls, standards, certifications, and/or regulations you comply with?
X
Governance and Risk ManagementPolicy Enforcement
GRM-07.1 Is a formal disciplinary or sanction policy established for employees who have violated security policies and procedures?
X
GRM-07.2 Are employees made aware of what actions could be taken in the event of a violation via their policies and procedures?
X
Governance and Risk ManagementBusiness / Policy Change Impacts
GRM-08.1 Do risk assessment results include updates to security policies, procedures, standards, and controls to ensure they remain relevant and effective?
X
Governance and Risk ManagementPolicy Reviews
GRM-09.1 Do you notify your tenants when you make material changes to your information security and/or privacy policies?
X
GRM-09.2 Do you perform, at minimum, annual reviews to your privacy and security policies?
X
Governance and Risk ManagementAssessments
GRM-10.1 Are formal risk assessments aligned with the enterprise-wide framework and performed at least annually, or at planned intervals, determining the likelihood and impact of all identified risks, using qualitative and quantitative methods?
X
00000013
Governance and Risk ManagementAssessments
GRM-10.2 Is the likelihood and impact associated with inherent and residual risk determined independently, considering all risk categories (e.g., audit results, threat and vulnerability analysis, and regulatory compliance)?
X
Governance and Risk ManagementProgram
GRM-11.1 Do you have a documented, organization-wide program in place to manage risk?
X
GRM-11.2 Do you make available documentation of your organization-wide risk management program?
X
Human ResourcesAsset Returns
HRS-01.1 Are systems in place to monitor for privacy breaches and notify tenants expeditiously if a privacy event may have impacted their data?
X
HRS-01.2 Is your Privacy Policy aligned with industry standards? XHuman ResourcesBackground Screening
HRS-02.1 Pursuant to local laws, regulations, ethics, and contractual constraints, are all employment candidates, contractors, and involved third parties subject to background verification?
X
Human ResourcesEmployment Agreements
HRS-03.1 Do you specifically train your employees regarding their specific role and the information security controls they must fulfill?
X
HRS-03.2 Do you document employee acknowledgment of training they have completed?
X
HRS-03.3 Are all personnel required to sign NDA or Confidentiality Agreements as a condition of employment to protect customer/tenant information?
X
HRS-03.4 Is successful and timed completion of the training program considered a prerequisite for acquiring and maintaining access to sensitive systems?
X
HRS-03.5 Are personnel trained and provided with awareness programs at least once a year?
X
Human ResourcesEmployment Termination
HRS-04.1 Are documented policies, procedures, and guidelines in place to govern change in employment and/or termination?
X
HRS-04.2 Do the above procedures and guidelines account for timely revocation of access and return of assets?
X
00000014
Human ResourcesPortable / Mobile Devices
HRS-05.1 Are policies and procedures established and measures implemented to strictly limit access to your sensitive data and tenant data from portable and mobile devices (e.g., laptops, cell phones, and personal digital assistants (PDAs)), which are generally higher-risk than non-portable devices (e.g., desktop computers at the provider organization’s facilities)?
X
Human ResourcesNon-Disclosure Agreements
HRS-06.1 Are requirements for non-disclosure or confidentiality agreements reflecting the organization's needs for the protection of data and operational details identified, documented, and reviewed at planned intervals?
X
Human ResourcesRoles / Responsibilities
HRS-07.1 Do you provide tenants with a role definition document clarifying your administrative responsibilities versus those of the tenant?
X
Human ResourcesAcceptable Use
HRS-08.1 Do you provide documentation regarding how you may access tenant data and metadata?
X
HRS-08.2 Do you collect or create metadata about tenant data usage through inspection technologies (e.g., search engines, etc.)?
X
HRS-08.3 Do you allow tenants to opt out of having their data/metadata accessed via inspection technologies?
X
Human ResourcesTraining / Awareness
HRS-09.1 Do you provide a formal, role-based, security awareness training program for cloud-related access and data management issues (e.g., multi-tenancy, nationality, cloud delivery model, segregation of duties implications, and conflicts of interest) for all persons with access to tenant data?
X
HRS-09.2 Are administrators and data stewards properly educated on their legal responsibilities with regard to security and data integrity?
X
Human ResourcesUser Responsibility
HRS-10.1 Are users made aware of their responsibilities for maintaining awareness and compliance with published security policies, procedures, standards, and applicable regulatory requirements?
X
HRS-10.2 Are users made aware of their responsibilities for maintaining a safe and secure working environment?
X
00000015
Human ResourcesUser Responsibility
HRS-10.3 Are users made aware of their responsibilities for leaving unattended equipment in a secure manner?
X
Human ResourcesWorkspace
HRS-11.1 Do your data management policies and procedures address tenant and service level conflicts of interests?
X
HRS-11.2 Do your data management policies and procedures include a tamper audit or software integrity function for unauthorized access to tenant data?
X
HRS-11.3 Does the virtual machine management infrastructure include a tamper audit or software integrity function to detect changes to the build/configuration of the virtual machine?
X
Identity & Access ManagementAudit Tools Access
IAM-01.1 Do you restrict, log, and monitor access to your information security management systems (e.g., hypervisors, firewalls, vulnerability scanners, network sniffers, APIs, etc.)?
X
IAM-01.2 Do you monitor and log privileged access (e.g., administrator level) to information security management systems?
X
Identity & Access ManagementUser Access Policy
IAM-02.1 Do you have controls in place ensuring timely removal of systems access that is no longer required for business purposes?
X
IAM-02.2 Do you provide metrics to track the speed with which you are able to remove systems access that is no longer required for business purposes?
X
Identity & Access ManagementDiagnostic / Configuration Ports Access
IAM-03.1 Do you use dedicated secure networks to provide management access to your cloud service infrastructure?
X
Identity & Access ManagementPolicies and Procedures
IAM-04.1 Do you manage and store the identity of all personnel who have access to the IT infrastructure, including their level of access?
X
IAM-04.2 Do you manage and store the user identity of all personnel who have network access, including their level of access?
X
00000016
Identity & Access ManagementSegregation of Duties
IAM-05.1 Do you provide tenants with documentation on how you maintain segregation of duties within your cloud service offering?
X
Identity & Access ManagementSource Code Access Restriction
IAM-06.1 Are controls in place to prevent unauthorized access to your application, program, or object source code, and assure it is restricted to authorized personnel only?
X All code repositories are internal and can only be accessed via a pre-configured SSH key from each deployiment host. All code is code reviewed before reaching the master deploy branch
IAM-06.2 Are controls in place to prevent unauthorized access to tenant application, program, or object source code, and assure it is restricted to authorized personnel only?
XBeing SaaS there is no tenant code or applications
Identity & Access ManagementThird Party Access
IAM-07.1 Do you provide multi-failure disaster recovery capability? XIAM-07.2 Do you monitor service continuity with upstream
providers in the event of provider failure?X
IAM-07.3 Do you have more than one provider for each service you depend on?
X
IAM-07.4 Do you provide access to operational redundancy and continuity summaries, including the services you depend on?
X
IAM-07.5 Do you provide the tenant the ability to declare a disaster?
X
IAM-07.6 Do you provide a tenant-triggered failover option? X There is no failover option for the tenant as they only see the main web application
IAM-07.7 Do you share your business continuity and redundancy plans with your tenants?
X All service impacting migrations and redundancy considerations are communicated to the tenants
Identity & Access ManagementUser Access Restriction / Authorization
IAM-08.1 Do you document how you grant and approve access to tenant data?
X
IAM-08.2 Do you have a method of aligning provider and tenant data classification methodologies for access control purposes?
X
00000017
Identity & Access ManagementUser Access Authorization
IAM-09.1 Does your management provision the authorization and restrictions for user access (e.g., employees, contractors, customers (tenants), business partners, and/or suppliers) prior to their access to data and any owned or managed (physical and virtual) applications, infrastructure systems, and network components?
X
IAM-09.2 Do you provide upon request user access (e.g., employees, contractors, customers (tenants), business partners and/or suppliers) to data and any owned or managed (physical and virtual) applications, infrastructure systems and network components?
X
Identity & Access ManagementUser Access Reviews
IAM-10.1 Do you require at least annual certification of entitlements for all system users and administrators (exclusive of users maintained by your tenants)?
X
IAM-10.2 If users are found to have inappropriate entitlements, are all remediation and certification actions recorded?
X
IAM-10.3 Will you share user entitlement remediation and certification reports with your tenants, if inappropriate access may have been allowed to tenant data?
X
Identity & Access ManagementUser Access Revocation
IAM-11.1 Is timely deprovisioning, revocation, or modification of user access to the organizations systems, information assets, and data implemented upon any change in status of employees, contractors, customers, business partners, or involved third parties?
X
IAM-11.2 Is any change in user access status intended to include termination of employment, contract or agreement, change of employment or transfer within the organization?
X
Identity & Access ManagementUser ID Credentials
IAM-12.1 Do you support use of, or integration with, existing customer-based Single Sign On (SSO) solutions to your service?
X
IAM-12.2 Do you use open standards to delegate authentication capabilities to your tenants?
X
IAM-12.3 Do you support identity federation standards (e.g., SAML, SPML, WS-Federation, etc.) as a means of authenticating/authorizing users?
X
00000018
Identity & Access ManagementUser ID Credentials
IAM-12.4 Do you have a Policy Enforcement Point capability (e.g., XACML) to enforce regional legal and policy constraints on user access?
X
IAM-12.5 Do you have an identity management system (enabling classification of data for a tenant) in place to enable both role-based and context-based entitlement to data?
X
IAM-12.6 Do you provide tenants with strong (multifactor) authentication options (e.g., digital certs, tokens, biometrics, etc.) for user access?
X
IAM-12.7 Do you allow tenants to use third-party identity assurance services?
X
IAM-12.8 Do you support password (e.g., minimum length, age, history, complexity) and account lockout (e.g., lockout threshold, lockout duration) policy enforcement?
X
IAM-12.9 Do you allow tenants/customers to define password and account lockout policies for their accounts?
X
IAM-12.10 Do you support the ability to force password changes upon first logon?
X
IAM-12.11 Do you have mechanisms in place for unlocking accounts that have been locked out (e.g., self-service via email, defined challenge questions, manual unlock)?
X
Identity & Access ManagementUtility Programs Access
IAM-13.1 Are utilities that can significantly manage virtualized partitions (e.g., shutdown, clone, etc.) appropriately restricted and monitored?
X
IAM-13.2 Do you have the capability to detect attacks that target the virtual infrastructure directly (e.g., shimming, Blue Pill, Hyper jumping, etc.)?
X
IAM-13.3 Are attacks that target the virtual infrastructure prevented with technical controls?
X
Infrastructure & Virtualization SecurityAudit Logging / Intrusion Detection
IVS-01.1 Are file integrity (host) and network intrusion detection (IDS) tools implemented to help facilitate timely detection, investigation by root cause analysis, and response to incidents?
X
IVS-01.2 Is physical and logical user access to audit logs restricted to authorized personnel?
X
00000019
Infrastructure & Virtualization SecurityAudit Logging / Intrusion Detection
IVS-01.3 Can you provide evidence that due diligence mapping of regulations and standards to your controls/architecture/processes has been done?
X
IVS-01.4 Are audit logs centrally stored and retained? XIVS-01.5 Are audit logs reviewed on a regular basis for security
events (e.g., with automated tools)?X
Infrastructure & Virtualization SecurityChange Detection
IVS-02.1 Do you log and alert any changes made to virtual machine images regardless of their running state (e.g., dormant, off or running)?
X
IVS-02.2 Are changes made to virtual machines, or moving of an image and subsequent validation of the image's integrity, made immediately available to customers through electronic methods (e.g., portals or alerts)?
X
Infrastructure & Virtualization SecurityClock Synchronization
IVS-03.1 Do you use a synchronized time-service protocol (e.g., NTP) to ensure all systems have a common time reference?
X
Infrastructure & Virtualization SecurityCapacity / Resource Planning
IVS-04.1 Do you provide documentation regarding what levels of system (e.g., network, storage, memory, I/O, etc.) oversubscription you maintain and under what circumstances/scenarios?
X
All virtualization is controlled by the cloud provider.
IVS-04.2 Do you restrict use of the memory oversubscription capabilities present in the hypervisor?
X
IVS-04.3 Do your system capacity requirements take into account current, projected, and anticipated capacity needs for all systems used to provide services to the tenants?
X
IVS-04.4 Is system performance monitored and tuned in order to continuously meet regulatory, contractual, and business requirements for all the systems used to provide services to the tenants?
X
Infrastructure & Virtualization SecurityManagement - Vulnerability Management
IVS-05.1 Do security vulnerability assessment tools or services accommodate the virtualization technologies being used (e.g., virtualization aware)?
X
00000020
Infrastructure & Virtualization SecurityNetwork Security
IVS-06.1 For your IaaS offering, do you provide customers with guidance on how to create a layered security architecture equivalence using your virtualized solution?
X
IVS-06.2 Do you regularly update network architecture diagrams that include data flows between security domains/zones?
X
IVS-06.3 Do you regularly review for appropriateness the allowed access/connectivity (e.g., firewall rules) between security domains/zones within the network?
X
IVS-06.4 Are all firewall access control lists documented with business justification?
x
Infrastructure & Virtualization SecurityOS Hardening and Base Controls
IVS-07.1 Are operating systems hardened to provide only the necessary ports, protocols, and services to meet business needs using technical controls (e.g., antivirus, file integrity monitoring, and logging) as part of their baseline build standard or template?
X
Infrastructure & Virtualization SecurityProduction / Non-Production Environments
IVS-08.1 For your SaaS or PaaS offering, do you provide tenants with separate environments for production and test processes?
X
IVS-08.2 For your IaaS offering, do you provide tenants with guidance on how to create suitable production and test environments?
X
IVS-08.3 Do you logically and physically segregate production and non-production environments?
X
Infrastructure & Virtualization SecuritySegmentation
IVS-09.1 Are system and network environments protected by a firewall or virtual firewall to ensure business and customer security requirements?
X
IVS-09.2 Are system and network environments protected by a firewall or virtual firewall to ensure compliance with legislative, regulatory, and contractual requirements?
XThere is no legislative, regulatory or contractual requirement to do so
IVS-09.3 Are system and network environments protected by a firewall or virtual firewall to ensure separation of production and non-production environments?
X
IVS-09.4 Are system and network environments protected by a firewall or virtual firewall to ensure protection and isolation of sensitive data?
X
00000021
Infrastructure & Virtualization SecurityVM Security - Data Protection
IVS-10.1 Are secured and encrypted communication channels used when migrating physical servers, applications, or data to virtual servers?
X
IVS-10.2 Do you use a network segregated from production-level networks when migrating physical servers, applications, or data to virtual servers?
X
Infrastructure & Virtualization SecurityVMM Security - Hypervisor Hardening
IVS-11.1 Do you restrict personnel access to all hypervisor management functions or administrative consoles for systems hosting virtualized systems based on the principle of least privilege and supported through technical controls (e.g., two-factor authentication, audit trails, IP address filtering, firewalls and TLS-encapsulated communications to the administrative consoles)?
X
Infrastructure & Virtualization SecurityWireless Security
IVS-12.1 Are policies and procedures established and mechanisms configured and implemented to protect the wireless network environment perimeter and to restrict unauthorized wireless traffic?
X
IVS-12.2 Are policies and procedures established and mechanisms implemented to ensure wireless security settings are enabled with strong encryption for authentication and transmission, replacing vendor default settings (e.g., encryption keys, passwords, SNMP community strings)?
X
IVS-12.3 Are policies and procedures established and mechanisms implemented to protect wireless network environments and detect the presence of unauthorized (rogue) network devices for a timely disconnect from the network?
X
Infrastructure & Virtualization SecurityNetwork Architecture
IVS-13.1 Do your network architecture diagrams clearly identify high-risk environments and data flows that may have legal compliance impacts?
X
IVS-13.2 Do you implement technical measures and apply defense-in-depth techniques (e.g., deep packet analysis, traffic throttling and black-holing) for detection and timely response to network-based attacks associated with anomalous ingress or egress traffic patterns (e.g., MAC spoofing and ARP poisoning attacks) and/or distributed denial-of-service (DDoS) attacks?
X
00000022
Interoperability & PortabilityAPIs
IPY-01.1 Do you publish a list of all APIs available in the service and indicate which are standard and which are customized?
X
Interoperability & PortabilityData Request
IPY-02.1 Is unstructured customer data available on request in an industry-standard format (e.g., .doc, .xls, or .pdf)?
X
Interoperability & PortabilityPolicy & Legal
IPY-03.1 Do you provide policies and procedures (i.e. service level agreements) governing the use of APIs for interoperability between your service and third-party applications?
X
IPY-03.2 Do you provide policies and procedures (i.e. service level agreements) governing the migration of application data to and from your service?
X
Interoperability & PortabilityStandardized Network Protocols
IPY-04.1 Can data import, data export, and service management be conducted over secure (e.g., non-clear text and authenticated), industry accepted standardized network protocols?
X
IPY-04.2 Do you provide consumers (tenants) with documentation detailing the relevant interoperability and portability network protocol standards that are involved?
X
Interoperability & PortabilityVirtualization
IPY-05.1 Do you use an industry-recognized virtualization platform and standard virtualization formats (e.g., OVF) to help ensure interoperability?
X
IPY-05.2 Do you have documented custom changes made to any hypervisor in use, and all solution-specific virtualization hooks available for customer review?
X
Mobile SecurityAnti-Malware
MOS-01.1 Do you provide anti-malware training specific to mobile devices as part of your information security awareness training?
X Mobile devices are not allowed to access or store relevant company data. Customer are responsible to manage mobile security devices and the access to the customer’s content on our platform
Mobile SecurityApplication Stores
MOS-02.1 Do you document and make available lists of approved application stores for mobile devices accessing or storing company data and/or company systems?
X
00000023
Mobile SecurityApproved Applications
MOS-03.1 Do you have a policy enforcement capability (e.g., XACML) to ensure that only approved applications and those from approved application stores can be loaded onto a mobile device?
X
Mobile SecurityApproved Software for BYOD
MOS-04.1 Does your BYOD policy and training clearly state which applications and applications stores are approved for use on BYOD devices?
X
Mobile SecurityAwareness and Training
MOS-05.1 Do you have a documented mobile device policy in your employee training that clearly defines mobile devices and the accepted usage and requirements for mobile devices?
X
Mobile SecurityCloud Based Services
MOS-06.1 Do you have a documented list of pre-approved cloud based services that are allowed to be used for use and storage of company business data via a mobile device?
X
Mobile SecurityCompatibility
MOS-07.1 Do you have a documented application validation process for testing device, operating system, and application compatibility issues?
X
Mobile SecurityDevice Eligibility
MOS-08.1 Do you have a BYOD policy that defines the device(s) and eligibility requirements allowed for BYOD usage?
X
Mobile SecurityDevice Inventory
MOS-09.1 Do you maintain an inventory of all mobile devices storing and accessing company data which includes device status (e.g., operating system and patch levels, lost or decommissioned, device assignee)?
X
Mobile SecurityDevice Management
MOS-10.1 Do you have a centralized mobile device management solution deployed to all mobile devices that are permitted to store, transmit, or process company data?
X
Mobile SecurityEncryption
MOS-11.1 Does your mobile device policy require the use of encryption for either the entire device or for data identified as sensitive enforceable through technology controls for all mobile devices?
X
Mobile SecurityJailbreaking and Rooting
MOS-12.1 Does your mobile device policy prohibit the circumvention of built-in security controls on mobile devices (e.g., jailbreaking or rooting)?
X
MOS-12.2 Do you have detective and preventative controls on the device or via a centralized device management system which prohibit the circumvention of built-in security controls?
X
00000024
Mobile SecurityLegal
MOS-13.1 Does your BYOD policy clearly define the expectation of privacy, requirements for litigation, e-discovery, and legal holds?
X
MOS-13.2 Do you have detective and preventative controls on the device or via a centralized device management system which prohibit the circumvention of built-in security controls?
X
Mobile SecurityLockout Screen
MOS-14.1 Do you require and enforce via technical controls an automatic lockout screen for BYOD and company owned devices?
X
Mobile SecurityOperating Systems
MOS-15.1 Do you manage all changes to mobile device operating systems, patch levels, and applications via your company's change management processes?
X
Mobile SecurityPasswords
MOS-16.1 Do you have password policies for enterprise issued mobile devices and/or BYOD mobile devices?
X
MOS-16.2 Are your password policies enforced through technical controls (i.e. MDM)?
X
MOS-16.3 Do your password policies prohibit the changing of authentication requirements (i.e. password/PIN length) via a mobile device?
X
Mobile SecurityPolicy
MOS-17.1 Do you have a policy that requires BYOD users to perform backups of specified corporate data?
X
MOS-17.2 Do you have a policy that requires BYOD users to prohibit the usage of unapproved application stores?
X
MOS-17.3 Do you have a policy that requires BYOD users to use anti-malware software (where supported)?
X
Mobile SecurityRemote Wipe
MOS-18.1 Does your IT provide remote wipe or corporate data wipe for all company-accepted BYOD devices?
X
MOS-18.2 Does your IT provide remote wipe or corporate data wipe for all company-assigned mobile devices?
X
Mobile SecuritySecurity Patches
MOS-19.1 Do your mobile devices have the latest available security-related patches installed upon general release by the device manufacturer or carrier?
X
MOS-19.2 Do your mobile devices allow for remote validation to download the latest security patches by company IT personnel?
X
00000025
Mobile SecurityUsers
MOS-20.1 Does your BYOD policy clarify the systems and servers allowed for use or access on the BYOD-enabled device?
X
MOS-20.2 Does your BYOD policy specify the user roles that are allowed access via a BYOD-enabled device?
X
Security Incident Management, E-Discovery, & Cloud ForensicsContact / Authority Maintenance
SEF-01.1 Do you maintain liaisons and points of contact with local authorities in accordance with contracts and appropriate regulations?
X
Security Incident Management, E-Discovery, & Cloud ForensicsIncident Management
SEF-02.1 Do you have a documented security incident response plan?
X
SEF-02.2 Do you integrate customized tenant requirements into your security incident response plans?
X
SEF-02.3 Do you publish a roles and responsibilities document specifying what you vs. your tenants are responsible for during security incidents?
X
SEF-02.4 Have you tested your security incident response plans in the last year?
X
Security Incident Management, E-Discovery, & Cloud ForensicsIncident Reporting
SEF-03.1 Does your security information and event management (SIEM) system merge data sources (e.g., app logs, firewall logs, IDS logs, physical access logs, etc.) for granular analysis and alerting?
X
SEF-03.2 Does your logging and monitoring framework allow isolation of an incident to specific tenants?
X
Security Incident Management, E-Discovery, & Cloud ForensicsIncident Response Legal Preparation
SEF-04.1 Does your incident response plan comply with industry standards for legally admissible chain-of-custody management processes and controls?
X
SEF-04.2 Does your incident response capability include the use of legally admissible forensic data collection and analysis techniques?
X
SEF-04.3 Are you capable of supporting litigation holds (freeze of data from a specific point in time) for a specific tenant without freezing other tenant data?
X A snapshot of the production data can be obtained and analyzed from there without distrupting the operations of other tenants
00000026
Security Incident Management, E-Discovery, & Cloud ForensicsIncident Response Legal Preparation
SEF-04.4 Do you enforce and attest to tenant data separation when producing data in response to legal subpoenas?
X
Security Incident Management, E-Discovery, & Cloud ForensicsIncident Response Metrics
SEF-05.1 Do you monitor and quantify the types, volumes, and impacts on all information security incidents?
X
SEF-05.2 Will you share statistical information for security incident data with your tenants upon request?
X
Supply Chain Management, Transparency, and AccountabilityData Quality and Integrity
STA-01.1 Do you inspect and account for data quality errors and associated risks, and work with your cloud supply-chain partners to correct them?
X
STA-01.2 Do you design and implement controls to mitigate and contain data security risks through proper separation of duties, role-based access, and least-privileged access for all personnel within your supply chain?
X
Supply Chain Management, Transparency, and AccountabilityIncident Reporting
STA-02.1 Do you make security incident information available to all affected customers and providers periodically through electronic methods (e.g., portals)?
X
Supply Chain Management, Transparency, and AccountabilityNetwork / Infrastructure Services
STA-03.1 Do you collect capacity and use data for all relevant components of your cloud service offering?
X
STA-03.2 Do you provide tenants with capacity planning and use reports?
X
Supply Chain Management, Transparency, and AccountabilityProvider Internal Assessments
STA-04.1 Do you perform annual internal assessments of conformance and effectiveness of your policies, procedures, and supporting measures and metrics?
X
Supply Chain Management, Transparency, and AccountabilityThird Party Agreements
STA-05.1 Do you select and monitor outsourced providers in compliance with laws in the country where the data is processed, stored, and transmitted?
X
STA-05.2 Do you select and monitor outsourced providers in compliance with laws in the country where the data originates?
X
STA-05.3 Does legal counsel review all third-party agreements? X
00000027
Supply Chain Management, Transparency, and AccountabilityThird Party Agreements
STA-05.4 Do third-party agreements include provision for the security and protection of information and assets?
X
STA-05.5 Do you provide the client with a list and copies of all subprocessing agreements and keep this updated?
X
Supply Chain Management, Transparency, and AccountabilitySupply Chain Governance Reviews
STA-06.1 Do you review the risk management and governanced processes of partners to account for risks inherited from other members of that partner's supply chain?
X
Supply Chain Management, Transparency, and AccountabilitySupply Chain Metrics
STA-07.1 Are policies and procedures established, and supporting business processes and technical measures implemented, for maintaining complete, accurate, and relevant agreements (e.g., SLAs) between providers and customers (tenants)?
X
STA-07.2 Do you have the ability to measure and address non-conformance of provisions and/or terms across the entire supply chain (upstream/downstream)?
X
STA-07.3 Can you manage service-level conflicts or inconsistencies resulting from disparate supplier relationships?
X
STA-07.4 Do you review all agreements, policies, and processes at least annually?
X
Supply Chain Management, Transparency, and AccountabilityThird Party Assessment
STA-08.1 Do you assure reasonable information security across your information supply chain by performing an annual review?
X
STA-08.2 Does your annual review include all partners/third-party providers upon which your information supply chain depends?
X
Supply Chain Management, Transparency, and AccountabilityThird Party Audits
STA-09.1 Do you permit tenants to perform independent vulnerability assessments?
X
STA-09.2 Do you have external third party services conduct vulnerability scans and periodic penetration tests on your applications and networks?
X
Threat and Vulnerability ManagementAntivirus / Malicious Software
TVM-01.1 Do you have anti-malware programs that support or connect to your cloud service offerings installed on all of your systems?
X
00000028
Threat and Vulnerability ManagementAntivirus / Malicious Software
TVM-01.2 Do you ensure that security threat detection systems using signatures, lists, or behavioral patterns are updated across all infrastructure components within industry accepted time frames?
X
Threat and Vulnerability ManagementVulnerability / Patch Management
TVM-02.1 Do you conduct network-layer vulnerability scans regularly as prescribed by industry best practices?
X
TVM-02.2 Do you conduct application-layer vulnerability scans regularly as prescribed by industry best practices?
X
TVM-02.3 Do you conduct local operating system-layer vulnerability scans regularly as prescribed by industry best practices?
X
TVM-02.4 Will you make the results of vulnerability scans available to tenants at their request?
X
TVM-02.5 Do you have a capability to rapidly patch vulnerabilities across all of your computing devices, applications, and systems?
X
TVM-02.6 Will you provide your risk-based systems patching time frames to your tenants upon request?
X
Threat and Vulnerability ManagementMobile Code
TVM-03.1 Is mobile code authorized before its installation and use, and the code configuration checked, to ensure that the authorized mobile code operates according to a clearly defined security policy?
X
TVM-03.2 Is all unauthorized mobile code prevented from executing?
X
© Copyright 2014 Cloud Security Alliance - All rights reserved. You may download, store, display on your computer, view, print, and link to the Cloud Security Alliance “Consensus Assessments Initiative Questionnaire CAIQ Version 3.0.1” at http://www.cloudsecurityalliance.org subject to the following: (a) the Consensus Assessments Initiative Questionnaire v3.0.1 may be used solely for your personal, informational, non-commercial use; (b) the Consensus Assessments Initiative Questionnaire v3.0.1 may not be modified or altered in any way; (c) the Consensus Assessments Initiative Questionnaire v3.0.1 may not be redistributed; and (d) the trademark, copyright or other notices may not be removed. You may quote portions of the Consensus Assessments Initiative Questionnaire v3.0.1 as permitted by the Fair Use provisions of the United States Copyright Act, provided that you attribute the portions to the Cloud Security Alliance Cloud Consensus Assessments Initiative Questionnaire 3.0.1 (2014). If you are interested in obtaining a license to this material for other usages not addresses in the copyright notice, please contact [email protected].